MACAU SAR, CHINA Law and Practice Contributed by: Pedro Cortés and Luís Rôlo, Lektou, Advogados e Notários
contact with it in connection with its purposes and that the data is not disclosed to a third party without the consent of the data sub - jects. Therefore, processing of trade union member - ship data is lawful in those two circumstances. The duty of the employer to notify the PDPB of the processing of personal data of its employees is waived in some cases, for example in respect of: • personal data necessary for processing of payroll and payroll-related obligations (Authorisation No 01/2007); • personal data necessary for processing of administrative management of the employ - ment relationship (Authorisation No 02/2007); and • processing of biometric data for attendance control purposes (Authorisation No 02/2020). The PDPB provides detailed recommendations on the use of personal data for supervision of employees activities in the workplace, empha - sising the principles of legality of purpose, non- excessive collection and including sample pri - vacy statements for processing of supervision of telephone calls, e-mail and internet usage and video surveillance. 4.4 Transfer of Personal Data in Asset Deals In asset deals, the standard provisions of the PDPA apply. Namely, the buyer, as a recipient for the personal data controlled by the seller, shall become the controller of the data. The data subjects’ right to information includes the identity of the recipients and the purposes of the disclosure of data to those recipients.
Besides, the identity and purposes of process - ing of the recipients are part of the notification to the PDPB and this notification might also need to be amended/updated. The recipient must fulfil the requirements of legitimacy for processing the transferred data. Therefore, either consent from the data subjects or another condition for legitimacy needs to be secured, along with a notification to the PDPB, whenever the processing is not already covered by such a notification. 5. International Considerations 5.1 Restrictions on International Data Transfers The transfer of personal data overseas can only take place in accordance with the provisions of the PDPA, and provided that the jurisdiction to which the data is going to be transferred ensures an adequate level of protection. This level of protection may be assessed by the PDPB on a case-by-case basis (Article 19 of the PDPA) but, in practice, the PDPB does not assess the adequacy of the level or protection guaranteed by the import jurisdiction. All cases are assessed under Article 20 of the PDPA on derogations (see below). Under the PDPA there is no provision enabling the publication of a list of jurisdictions capable of ensuring the level of protection that is imposed by the PDPA (no “white list”). The transfer of data overseas may be possible under the various exceptions provided by the PDPA.
292 CHAMBERS.COM
Powered by FlippingBook